1c5adb04f63934bfc76eefa257d985e8e6bafa4c25c0343714a0845e9da6b163

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 219KB
Sample260818-wp32ssyyft
SHA256 1c5adb04f63934bfc76eefa257d985e8e6bafa4c25c0343714a0845e9da6b163
MD5 b2091713ed192c47c6521016c7045054
SHA1 0096b3cd1e5f093be9fcd178d846cd4d6b5c1333
SHA512 da284408e4f88ff97981342f495347a76004519011d0ffe2a20686ad50f69ddab5e7c600462a5797a537f8fbc4b8923fb6083aa39f7f48c9a7b9238eb2e1eb31
SSDEEP 3072:7p24M1nQdMC5iUyRF9JNHmjw3peoH7f6ds3NiTFh9aJMziV2:7p240BJTBrGj/YimEVuV
TLSH
T1C5249D15E7E50CFAE1B78679C9524902EB327C464760DADF03904EA69F27AD08F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1884	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1884	1300	loader.exe	91

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads